Painless regex unrestricted
Painless regular expressions are fully enabled (script.painless.regex.enabled is true). Some patterns are extremely CPU- and memory-heavy.
For a complete list of insights, refer to AutoOps insights.
| Field | Value |
|---|---|
| Component | Elasticsearch |
| Severity | Medium |
| Scope | Cluster |
| Domains | performance, security-safety |
The following is an example of what you might see when this insight is triggered. Real insights use live data and links from your deployment or cluster.
script.painless.regex.enabled is true. Regular expressions in Painless run without the complexity limit.
AutoOps shows different recommendations depending on how their conditions match your deployment or cluster.
Limit Painless regex complexity
Condition: Always shown for this insight.
Set script.painless.regex.enabled to limited unless you have a measured need for unrestricted regex. Use false only if no Painless regex should run. Add the setting in elasticsearch.yml on every node, then restart each node.
script.painless.regex.enabled: limited
true removes the complexity cap. Elasticsearch default is limited.
Regular expressions in Painless can search or transform text with flexible patterns. Some expressions consume large amounts of CPU and memory and can stall ingest, update-by-query, or search on the node.
Elasticsearch turns off unbounded regex by default. The limited value allows regex with a complexity cap. true removes that cap.
Use unrestricted regex only when you have a measured need. Prefer limited when you need Painless regex at all.